CVE-2026-100727
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
- Published Oct 5, 2026
- CVSS 6.9 medium
- 0.2% chance of exploitation in the next 30 days (EPSS)